Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 21-threat-intelligencegit clone --depth 1 https://github.com/Masriyan/Claude-Code-CyberSecurity-SkillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/masriyan/claude-code-cybersecurity-skill/21-threat-intelligence)<a href="https://agentmods.dev/skills/masriyan/claude-code-cybersecurity-skill/21-threat-intelligence"><img src="https://agentmods.dev/badge/skills/masriyan/claude-code-cybersecurity-skill/21-threat-intelligence/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/masriyan/claude-code-cybersecurity-skill/21-threat-intelligence"><img src="https://agentmods.dev/badge/skills/masriyan/claude-code-cybersecurity-skill/21-threat-intelligence.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00057 | $0.03218 |
| Opus 5 | $0.00028 | $0.01609 |
| Sonnet 5 | $0.00011 | $0.00644 |
| Haiku 4.5 | $0.00006 | $0.00322 |
Grade A, and why
Threat Intelligence & CTI scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 205 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Threat Intelligence & CTI
Purpose
Enable Claude to turn raw observations into finished intelligence — assessments a defender can act on and decision-makers can trust. This skill governs the whole intelligence cycle: framing requirements, collecting and normalizing indicators, applying structured analytic models, scoring sources and confidence, tracking actors and campaigns, and disseminating in machine-readable (STIX/MISP) and human-readable (report) form.
This is distinct from Skill 06 (Threat Hunting): hunting uses intelligence to search an environment for adversary activity; this skill produces and manages the intelligence itself. It is also distinct from Skill 05 (Malware Analysis), which produces the technical facts this skill contextualizes and disseminates.
Activation Triggers
This skill activates when the user asks about:
- Extracting, defanging/refanging, normalizing, or deduplicating IOCs from reports, emails, or feeds
- Producing a STIX 2.1 bundle, a MISP event, or a TAXII-servable indicator set
- Scoring the reliability of a source or the confidence of an assessment (Admiralty/NATO code, words of estimative probability)
- Applying the Diamond Model, Cyber Kill Chain, or MITRE ATT&CK to structure an intrusion
- Tracking or clustering a threat actor / campaign, or reasoning about attribution
- Writing a tactical, operational, or strategic threat intelligence report or an intelligence estimate
- Setting Priority Intelligence Requirements (PIRs) or building a collection plan
- TLP marking, intelligence dissemination, or feed aging/decay and false-positive suppression
- Enriching an indicator (WHOIS/passive DNS/reputation) or pivoting from one indicator to related infrastructure
Prerequisites
python3 --version # 3.10+; standard library only for the core script
pip install requests # optional — only for --enrich (live reputation/WHOIS lookups)
Optional enhanced tooling:
misp/ PyMISP — event creation and sharing on a MISP instancestix2/taxii2-client(OASIS) — richer STIX object modeling and TAXII push/pullopencti— CTI platform for actor/campaign knowledge-graph management- A passive-DNS / reputation provider (VirusTotal, Shodan, GreyNoise, urlscan) for enrichment
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 205 lines · 57 tokens per session scan A 47b5edd13b3f
Threat Intelligence & CTI is a skill published in the GitHub repository Masriyan/Claude-Code-CyberSecurity-Skill (409 stars, last pushed 3d ago), licensed MIT. It adds 57 tokens to every session and 3,218 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-08.
Other skills, from other repositories
analyzing-campaign-attribution-evidence
Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments. Use…
collecting-threat-intelligence-with-misp
MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform for gathering, sharing, storing, and correlating Indicators of Compromise (IOCs) of targeted attacks, threat.
analyzing-campaign-attribution-evidence
Use when campaign attribution analysis involves systematically evaluating evidence to determine which threat actor or group is responsible for a cyber operation. This skill covers collecting and weighting attr.
collecting-threat-intelligence-with-misp
Deploy MISP, configure threat feeds (MISP community, freetext, TAXII, CSV), and use the PyMISP API to programmatically fetch, add, and search events and IOCs, building automated collection pipelines that aggregate indicators from community and commercial sources. Use when gathering, storing, or correlating IOCs and…
analyzing-campaign-attribution-evidence
Campaign attribution analysis involves systematically evaluating evidence to determine which threat actor or group is responsible for a cyber operation. This skill covers collecting and weighting attr.
collecting-threat-intelligence-with-misp
MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform for gathering, sharing, storing, and correlating Indicators of Compromise (IOCs) of targeted attacks, threat.